# DSH Supreme v1.1 — SUPREME composition fragment (bundle users).
#
# Recomposes the seven bundle rows to the full SUPREME composition (Spec §16
# + the Spec §30 keyless synthetic scenario): every plugin active, router
# seeded with the synthetic free/paid candidate pair, PAID rejected by the
# policy gate (executionClass SUPREME keeps allowPaid=false), verifier
# command-capable=false. Drive gate scenarios from your own code against the
# ctx services (the gate driver fixture is not part of the bundle).
#
# Patch semantics (vendor/include applyEntryPatches, the exact algorithm boot
# uses): rows here are UPDATE patches — they target rows the bundle layer
# inserted by `id`, replacing each row's whole `config`. They intentionally
# carry NO `name`: an update patch's name must match the installed row's
# resolved name verbatim, which is install-location-dependent, so restating
# it here would be skipped.
#
# Apply with ONE of:
#   1. overlay (no file edits):
#      dsh --profile <name> --patch "$DSH_HOME/profiles/<name>/node_modules/dsh-supreme/config/compositions/supreme.patch.yml"
#   2. copy the rows below into your profile's cordis.patch.yml (last write
#      wins per row id).
#
# Paths are RELATIVE to the dsh process working directory. Override any row
# from your own patch layer — user layers always win.
#
# The router candidates below are the SYNTHETIC demo pair (credential mode
# config-owned, documented synthetic assumption). For production, replace
# them from your own patch layer with YOUR providers — last write per row
# replaces the whole config.
#
# v1.3.1 review-hardening posture (production-conservative; see
# docs/REVIEW-FIXES-v1.3.1.md for the evidence):
#   - PRE-DISPATCH COST ENFORCEMENT (FIX-A) is structural, not a config key:
#     the router adapter consults supremePolicy at agent/request AND
#     llm/stream before any dispatch and refuses paid/unknown routes. There
#     is deliberately no off-switch; the only legitimate way to dispatch a
#     paid route is the LAB policy override (executionClass LAB + allowPaid).
#   - capabilityClassGate: AUDIT stays the conservative posture (same as
#     v1.3 standard): unsanctioned labels are audited, not denied.
#   - fastPath enabled: simple labeled tasks (SUMMARIZE/TRANSLATE/...) route
#     directly with fanout 0 — opt-in here, still risk-gated (a measured
#     non-LOW risk always takes the normal routing path).
#   - bounds/outcomeCircuit/classAware keep their behavior-preserving
#     defaults; they are pinned explicitly below so a bundle-default drift
#     is visible in review.

- id: supreme-policy
  config:
    executionClass: SUPREME
    # v1.3: audit-only ASTRA posture (same as standard — ENFORCE and sanction
    # lists stay operator choices; see the lab fragment for the enforcing demo).
    enableEncodingScan: true
    capabilityClassGate: AUDIT

- id: supreme-observability
  config:
    dataDir: '.supreme-data/observability'

- id: supreme-benchmark
  config:
    dataDir: '.supreme-data/benchmark'
    # v1.3 anti-sandbagging: quality-score claims without verifier-PASS
    # evidence are flagged `evidenceBacked: false` on the score + run records
    # (flag only — scores are never rewritten).
    requireEvidenceForScores: true
    # v1.3.1 (IMP-R §5): recovery checkpoints — append-only checkpoints.jsonl
    # in the benchmark dataDir this plugin already owns. Resume re-plans from
    # TRUE state (artifact hashes re-checked) and NEVER auto-repeats a
    # completed side effect. Defaults pinned explicitly; no I/O until used.
    checkpoints:
      fileName: checkpoints.jsonl
      maxEntries: 1024

- id: supreme-fake-llm
  config:
    provider: synthetic-free

- id: supreme-router
  config:
    candidates:
      - provider: synthetic-free
        credentialMode: config-owned
        credentialConfigured: true
        quotaHeadroom: 0.95
        models:
          - model: synthetic-mini
            costClass: FREE_CONFIRMED
            capabilities: [chat]
            contextWindow: 32768
            failureDomain: synthetic
      - provider: synthetic-paid
        credentialMode: config-owned
        credentialConfigured: true
        quotaHeadroom: 0.9
        models:
          - model: synthetic-paid-large
            costClass: PAID
            capabilities: [chat]
            contextWindow: 131072
            failureDomain: synthetic-paid
    # v1.3.1 (IMP-R) outcome-routing keys, pinned at their defaults:
    #   - fastPath enabled (see header): simple labeled tasks route directly.
    #   - bounds: retry-storm limits — 3 dispatch attempts per task, fallback
    #     fanout ≤ 4, wall-clock budget OFF (0).
    #   - outcomeCircuit: 3 consecutive real failures open the route for
    #     cooldownMs; a single half-open probe then gates recovery.
    #   - classAware: per-task-class Wilson lower-bound scoring with a fixed
    #     1-hour recency half-life, fed from real benchmark history.
    fastPath:
      enabled: true
    bounds:
      maxRetries: 3
      maxFanout: 4
      wallClockBudgetMs: 0
    outcomeCircuit:
      enabled: true
      consecutiveFailures: 3
      cooldownMs: 60000
    classAware:
      enabled: true
      halfLifeMs: 3600000
      sampleLimit: 512

- id: supreme-verifier
  config:
    allowedRoots:
      - '.supreme-data'

- id: supreme-memory-policy
  config:
    registerPromptSection: false
    # v1.3.1 (FIX-C): selections are (session, task)-owned in a bounded LRU
    # store — no cross-session/cross-task fallback, unknown identity renders
    # nothing. The cap floor is 8 (adapter boundary); 128 is the default.
    selectionStoreCap: 128
    projectKnowledge:
      - id: project-overview
        text: 'DSH Supreme v1: seven host-side policy plugins composed on DeepSeek Harness.'
        priority: 60

- id: supreme-workflow-policy
  config:
    # v1.3 A2A + overreach keys pinned at their behavior-preserving defaults:
    # the graph is EMPTY so the contact policy stays inert, and the HIGH risk
    # ceiling is unchanged. Declare edges / lower the ceiling from your own
    # patch layer (LOG_ONLY audits out-of-graph contacts; DENY blocks them).
    agentContactPolicy: LOG_ONLY
    allowedContacts: []
    maxRiskLevel: HIGH
    approvalRequiredFor: []
    # v1.3.1 (FIX-D): A2A inspection is registry-first — tool identity comes
    # from the trusted default registry (subagent/send_message/...), extended
    # ADD-ONLY by this list. Ordinary tools whose arguments merely contain
    # `target`/`to`/`agent_id` (e.g. copy_file) are never inspected. Register
    # YOUR host's communication tools here if they are not in the default set.
    commsToolNames: []